15 ms·

Windows 10: HOSTS file blocking telemetry is now flagged as a risk

268 points by maltalex 6y ago

maltalex 6y ago
> In our tests, some of the Microsoft hosts detected in the Windows 10 HOSTS file include the following: www.microsoft.com microsoft.com telemetry.microsoft.com wns.notify.windows.com.akadns.net v10-win.vortex.data.microsoft.com.akadns.net us.vortex-win.data.microsoft.com us-v10.events.data.microsoft.com urs.microsoft.com.nsatc.net watson.telemetry.microsoft.com watson.ppe.telemetry.microsoft.com vsgallery.com watson.live.com watson.microsoft.com telemetry.remoteapp.windowsazure.com telemetry.urs.microsoft.com I can see the argument for disallowing remapping Microsoft domains in the hosts file as a security precaution [0], but this seems a bit heavy handed. Oh well, there's always pihole. Edit: On second thought, how long before they just start hard coding IP addresses? [0]: https://blog.malwarebytes.com/cybercrime/2016/09/hosts-file-hijacks/ https://blog.malwarebytes.com/cybercrime/2016/09/hosts-file-...
- dvfjsdhgfv 6y ago
  > Edit: On second thought, how long before they just start hard coding IP addresses? What would be the benefit of it? IP addresses are as easy to block as domain names, but the number of IP adresses available to them is much smaller than the number of possible domain names.
  - deleted 6y ago
    [deleted]
  - Mindwipe 6y ago
    > IP addresses are as easy to block as domain names, but the number of IP adresses available to them is much smaller than the number of possible domain names. Is it? If they wanted to be toxic they could mix the telemetry IPs around with the windows update IPs inside a fairly significant block of IPv6 addresses. It would be hard to block the entire range because you'd hit the update servers.
  - DoctorOW 6y ago
    Yeah but the point of this from an anti-virus point of view is to prevent redirects. Easier to redirect a domain name via DNS than an IP address.
- matoro 6y ago
  They already do that. If you block these domains at the DNS level it will just skip the DNS lookup and talk to them directly by IP.
  - spyder 6y ago
    Can you block them with the windows firewall? Would not trust that 100% but I'm curious if they allow it.
    - bserge 6y ago
      Well, I see compattelrunner.exe blocked in Windows Firewall (I use Malwarebytes Firewall Control in interactive mode and block/allow stuff manually), so it's likely working :D
  - nominated1 6y ago
    Not that I don’t believe this is happening, but I’d love to see the Wireshark logs proving this.
- slg 6y ago
  >I can see the argument for disallowing remapping Microsoft domains in the hosts file as a security precaution [0], but this seems a bit heavy handed. This is a crucial point here. I would be curious to see a list of Microsoft sites that you are allowed to redirect in the HOSTS file. Having a more complete list of protected/unprotected domains would give us a better indication if this is an overly aggressive attempt to protect users from legitimate threats or a malicious attempt to protect Microsoft's access to users’ data. Because blocking redirects on microsoft.com certainly seems smart, but blocking redirect of telemetry.remoteapp.windowsazure.com seems suspicious.
  - ufmace 6y ago
    I'm sure there's plenty of hackers, government agencies, etc that would just love to redirect telemetry from specific targets' Windows computers to servers they control. Not to say that it going to Microsoft is necessarily that much better, or that they may have deliberately also sabotaged people trying to redirect it to localhost, but still, it's a thing.
    - dividedbyzero 6y ago
      But could they? Verifying the host on the other end is the real deal doesn't appear to be too hard. I would be surprised if Microsoft relied solely on plain DNS for that.
    - abiogenesis 6y ago
      This is what technologies like TLS and certificate pinning are for. Watching the hosts file is only meant to be a nuisance for the end user.
  - Causality1 6y ago
    Considering how Windows 10 until very recently pitched an absolute fit when the user tried to change the default browser away from Edge, I'm gonna go with the latter.
- ryan29 6y ago
  > Edit: On second thought, how long before they just start hard coding IP addresses? I think it’ll eventually go to DoH with hard to block IPs (ex: Cloudflare IPs are tough to block because you break too much stuff). I’ve always believed a large part of the push for TLS, DoH, eSNI, etc. is to eliminate our ability to filter network traffic. It’s sold as a freedom thing, but I’m sceptical.
  - pas 6y ago
    If Windows will hard-code IPs, there will be tools to patch them out. And simply not using Windows is a very real possibility too, even if there are obvious inconveniences with going down that route (either OSX or Linux). That said TLS and other network security features are fundamental building blocks, but obviously in oppressive regimes where they stand out they have also the potential to bring the most value. And in parts of the world where network censorship is not a problem, there the features might benefit greedy corporations in a quasi-oligopoly a lot more than the users. But that's not necessarily an argument against these features.
    - AstralStorm 6y ago
      Patching Windows code will break updates and will definitely be flagged as risk. You would have to black hole the IPs on the router, as even Windows Firewall might not have the authority.
      - pas 6y ago
        The risk thing will be patched out too, naturally, I assume, just as with game cracks. And yes, the updates will just restore everything, scream and scold the user. So there will be users that don't update ...
LinuxBender 6y ago
Telemetry isn't even the nasty one. Look for "activity" in your DNS logs. Just try to block that... All the Windows 10 machines (home and pro) on your network will freeze up and hang for extended periods of time. Microsoft wants to know every time you spawn an application, what it was, who launched it. It doesn't matter how you block it, NXDOMAIN, REFUSE, fake IP, null route, all of those will cause machines to hang. A tcp-reset will reduce the impact a little. [Edit] MS may have wised up and consolidated the activity endpoints / vips into another endpoint. You may have to clear cache on the PC and your router, reboot and watch DNS requests as you launch applications to see where they moved. To stop this behavior requires registry changes unless you are on Enterprise or LTSC in which case you can use GPO. There are some free programs that will do the registry tweaks for you. Here is a video talking about manually changing some things [1] and they link to free tools that can do the changes as well [2]. [1] - https://www.youtube.com/watch?v=tgW7iXejfqQ https://www.youtube.com/watch?v=tgW7iXejfqQ [2] - https://www.oo-software.com/en/shutup10 https://www.oo-software.com/en/shutup10
- at_a_remove 6y ago
  Ah, LTSC ... never has one of my hunch-based technical decisions kept paying off again and again. if only I knew the right people instead of having to get licenses in very sketchy ways.
  - jabroni_salad 6y ago
    Just get yourself a volume license and talk to a distributor. You do not need any crazy volume. I was able to get it in place, legitimately, for a metal fabricator that has maybe 20 computers total not including their operational technology (CNC devices) that they wanted LTSC for. https://www.cdw.com/search/?key=ltsc&searchscope=all&sr=1 https://www.cdw.com/search/?key=ltsc&searchscope=all&sr=1
    - at_a_remove 6y ago
      As just a guy? Not so easy. I'm not a company, I'm just a person.
AlexDragusin 6y ago
Skip the Windows HOSTS file and use something like Acrylic DNS[0], works great for me and supports wildcards. I even use it together with the router to have my phone use the DNS and you can see which hosts get connected and so on as you use the phone. It ain't pretty. [0]: https://mayakron.altervista.org/support/acrylic/Home.htm https://mayakron.altervista.org/support/acrylic/Home.htm
- cdurth 6y ago
  any curated block lists you recommend for the lazy?
  - ffpip 6y ago
    I have an extremely basic one on my Windows machine - https://pastebin.com/ZfUv6E2c https://pastebin.com/ZfUv6E2c Bing, Facebook, Windows Web Search and some other sites don't work (unless you use DNS over https in Firefox, which ignores the host files.) Go through r/pihole for the recommended ones.
- rasz 6y ago
  Running Acrylic DNS (or any other local DNS server) wont do you any good because Windows firewall (or any software firewall for that matter?) cant/wont filter localhost (127.0.0.1), meaning you cant whitelist programs for DNS access :(. I want to not only be in control of what my DNS returns, but also who can access it in the first place. I want a popup the second something other than on my whitelist queries DNS. This works in windows as long as you kill DNSCache service. I havent investigated yet the possibility of using virtual lan adapter with separate subnet dedicated to DNS and if that can be filtered using Windows firewall.
a012 6y ago
For DNS blocking, I've switched my home devices to NextDNS and it works great. It has DoH/DoT, bundles a lot of blocking lists and has no logs option which are all I need. And I can manually add these domain names to blocklist if they're not added in any one yet.
rafaelturk 6y ago
This should somehow be defined as ilegal. I, as user, should have the power, to definitely, unquestionably block MS to track my computer.
- jackbrookes 6y ago
  You do, by uninstalling Windows.
- yjftsjthsd-h 6y ago
  I'm actually curious if this happens in the EU, and if so how it doesn't violate GDPR.
  - ClikeX 6y ago
    I'm not a lawyer, but I think might depend on what data is being collected here. I believe they'd be fine if it doesn't fall under the "personal data" category. You might actually be accepting some GDPR processing agreement when setting up Windows nowadays. And there's a whole thing in GDPR about grandfathering consent. Which they might fall back on. But like I said, I'm not a lawyer. I'm not qualified enough to know for sure.
    - anoncake 6y ago
      > You might actually be accepting some GDPR processing agreement when setting up Windows nowadays. If you don't know if you "accepted" an agreement, you didnt.
      - ClikeX 6y ago
        I didn't mean it in the sense that it's invisible. I haven't done a Windows install in a while, so I just don't know if they do a privacy agreement in the installation. As I mentioned in another comment. I wonder if they would try to extend Microsoft account privacy agreements to the installation of Windows where that account is logged into.
    - 6y ago
frou_dh 6y ago
If I lost trust in an OS, I would stop running it. Trying to fight an OS as a mere client of the OS is asymmetric warfare
- bzb3 6y ago
  There are no alternatives, that's why people have to fight Windows.
  - numpad0 6y ago
    Closing bugs.launchpad. net/ubuntu/+bug/1 was a mistake, now I understand.
    - bzb3 6y ago
      It was chest-thumping. Mark basically moved the goalposts so he could claim victory. The future he had originally envisioned will never come to fruition.
  - tigrezno 6y ago
    What? There are no alternatives because people don't adopt the alternatives. If a mere 10% of the Microsoft user base moved to Linux you'd see lots of changes from comercial software vendors. But I suppose it's easier to pirate Windows and cry in online forums.
  - t0astbread 6y ago
    There are alternatives, you just have to accept that not every operating system is exactly like Windows and that it takes time to learn something new. But you can multi-boot while doing that and gradually move your workflow away from Windows. Maybe there's still something that actually doesn't work outside of Windows at the end but the majority of your life will probably be spent on an OS that you (hopefully) don't have to fight.
    - Fauntleroy 6y ago
      If you're using Windows for PC gaming, there are often no real alternatives. It's not always about workflows and compiling.
fortran77 6y ago
These blocks may also prevent Microsoft from getting updates, including new virus scanning profiles. I'd say that blocking access to them could be a risk.
- dylan604 6y ago
  "Accept our tracking your every move or you don't get virus updates" sounds like "Give me your wallet and I won't shoot you".
jedisct1 6y ago
Block these domains with dnscrypt-proxy instead.
metalliqaz 6y ago
I have Win10 Enterprise from a corporate MSDN license. So, I just used gpedit to disable telemetry. What else should I be doing to my install to get rid of all the "leakiness"?
- metalliqaz 6y ago
  Actually I found this, which seems to be comprehensive (though a bit out of date) https://proprivacy.com/privacy-service/guides/how-to-disable-windows-10-data-collection https://proprivacy.com/privacy-service/guides/how-to-disable...
  - Spunkie 6y ago
    Doesn't seem very comprehensive if you are using an enterprise of LTSC build, no mention of gpedit.
- Lammy 6y ago
  I set up my own Windows 2019 domain for this same reason and ended up having to go over basically every available GP over the course of a weekend. There are just too many, and a lot of them require careful reading to know what they actually do since MS options tend to be in the form of "Enable the disabling of something" lol. Even the telemetry option itself is like that, since turning it "On" and to Enterprise-only level 0 leaks less data than turning it "Off" https://i.imgur.com/0Iplagu.png https://i.imgur.com/0Iplagu.png
  - metalliqaz 6y ago
    cool thanks
fbelzile 6y ago
That's not all. Starting in Windows 8, Windows silently ignores entries in the hosts file for popular domains (ex: facebook.com). The only way to stop this is to add a file exception for C:\Windows\system32\drivers\etc\hosts in Windows Defender. As far as I know, there was no documentation explaining this. Also, I don't know what threat model they're using to make these decisions. If you can edit the hosts file with administrative privileges, you can also add registry entry that adds a file exception in Windows Defender with the same permissions...
- bserge 6y ago
  It was working for me last year, and I literally just tried it with "127.0.0.1 facebook.com" + "127.0.0.1 www.facebook.com" and it still works.
nvr219 6y ago
Do pi-hole you fools
Wowfunhappy 6y ago
Want to Jailbreak your iPhone with unc0ver? You're probably going to go to unc0ver.dev and download unc0ver.ipa for sideloading. However, if you're on Windows 10, you may find that the the ipa file suddenly disappears from your PC as soon as it has finished downloading. Surprise! Windows Defender detected the Jailbreak and helpfully removed the file to keep you safe! This is not a false positive, Windows Defender literally lists "Jailbreak" as the reason the file is dangerous. Never mind that it's a user-initiated jailbreak for an entirely different, non-Microsoft Operating System! Repeat the same process on macOS—y'know, the OS from a company that actually has an interest in stopping this stuff. Does unc0ver.ipa get deleted by XProtect? Nope! Apple understands that these systems should only ever be used for actual viruses. To do anything else is a severe betrayal of user trust. IMO, Windows Defender has jumped the shark, and sadly, I've now resorted to disabling it on all personal Windows machines.
- ZekeSulastin 6y ago
  I downloaded the unc0ver IPA just now. Still there. Ran a scan on my downloads folder to see if it gets picked up. Still there. Don't know what the heck is going on with your system shrug
  - Wowfunhappy 6y ago
    Huh, well I last did this around a year ago, so it may be that an update to either Windows Defender or unc0ver fixed/avoided the problem. The fact that it happened at all, however, seriously doesn't sit right with me.
    - kbenson 6y ago
      > The fact that it happened at all, however, seriously doesn't sit right with me. It probably detected some of the techniques they used in the file as things used in exploits (since there's little difference in a jailbreak/security exploit from a technical perspective). The fact that it catches is in that case a good thing. That it doesn't catch it anymore might point towards them getting a report that it's a false positive of their automated binary matching, and making an exception to allow it. Apple not catching it could then indicate that either Apple already allowed it, or Apple's exploit detection is less sophisticated and wasn't able to see the problem. I don't know if that situation is correct, but it seems just as plausible to me, and in that case, Defender is doing exactly what I would want, responded to a report exactly as I would want and expect, and has multiple mechanisms to bypass the initial problem (add folder that's not scanned, disable entirely, etc), and your experience with Apple points towards them either being a little quicker with the exception or just worse at doing what I would want.
Justsignedup 6y ago
www.microsoft.com is also used for updates. By doing this block a lot of viruses prevent defender and windows from patching.
pojntfx 6y ago
Use Linux
afrcnc 6y ago
The article's title is misleading and clickbait. Windows is not flagging telemetry. It's flagging remapping of Microsoft domains, which is a very big no-no for every vendor.
- JadeNB 6y ago
  > The article's title is misleading and clickbait. Windows is not flagging telemetry. It's flagging remapping of Microsoft domains, which is a very big no-no for every vendor. The title is: > Windows 10: HOSTS file blocking telemetry is now flagged as a risk That seems clear to me about what is being flagged. I don't see any implication that telemetry is being flagged, and I'm not quite sure why anyone would think it would be—although I'd love it if Windows were to start reporting that its own telemetry was a risk, I don't see that in the cards.
fractal618 6y ago
It must be hard making decisions at that level.
firebaze 6y ago
Users blocking telemetry using .../etc/hosts are presumably power users, and, as such, are informed about this new twist - and this twist may even inform them that Microsoft uses IPs as a fallback in case DNS resolution fails. The outcome of this stunt may thus be worse than before it. So what is to be gained from this?
wayneftw 6y ago
The Pro and higher versions allow you to just disable Defender via GPO. That’s what I always do anyway.

268 points by maltalex 6y ago

> In our tests, some of the Microsoft hosts detected in the Windows 10 HOSTS file include the following: www.microsoft.com microsoft.com telemetry.microsoft.com wns.notify.windows.com.akadns.net v10-win.vortex.data.microsoft.com.akadns.net us.vortex-win.data.microsoft.com us-v10.events.data.microsoft.com urs.microsoft.com.nsatc.net watson.telemetry.microsoft.com watson.ppe.telemetry.microsoft.com vsgallery.com watson.live.com watson.microsoft.com telemetry.remoteapp.windowsazure.com telemetry.urs.microsoft.com I can see the argument for disallowing remapping Microsoft domains in the hosts file as a security precaution [0], but this seems a bit heavy handed. Oh well, there's always pihole. Edit: On second thought, how long before they just start hard coding IP addresses? [0]: https://blog.malwarebytes.com/cybercrime/2016/09/hosts-file-hijacks/ https://blog.malwarebytes.com/cybercrime/2016/09/hosts-file-...

dvfjsdhgfv 6y ago
> Edit: On second thought, how long before they just start hard coding IP addresses? What would be the benefit of it? IP addresses are as easy to block as domain names, but the number of IP adresses available to them is much smaller than the number of possible domain names.
- deleted 6y ago
  [deleted]
- Mindwipe 6y ago
  > IP addresses are as easy to block as domain names, but the number of IP adresses available to them is much smaller than the number of possible domain names. Is it? If they wanted to be toxic they could mix the telemetry IPs around with the windows update IPs inside a fairly significant block of IPv6 addresses. It would be hard to block the entire range because you'd hit the update servers.
- DoctorOW 6y ago
  Yeah but the point of this from an anti-virus point of view is to prevent redirects. Easier to redirect a domain name via DNS than an IP address.
matoro 6y ago
They already do that. If you block these domains at the DNS level it will just skip the DNS lookup and talk to them directly by IP.
- spyder 6y ago
  Can you block them with the windows firewall? Would not trust that 100% but I'm curious if they allow it.
  - bserge 6y ago
    Well, I see compattelrunner.exe blocked in Windows Firewall (I use Malwarebytes Firewall Control in interactive mode and block/allow stuff manually), so it's likely working :D
- nominated1 6y ago
  Not that I don’t believe this is happening, but I’d love to see the Wireshark logs proving this.
slg 6y ago
>I can see the argument for disallowing remapping Microsoft domains in the hosts file as a security precaution [0], but this seems a bit heavy handed. This is a crucial point here. I would be curious to see a list of Microsoft sites that you are allowed to redirect in the HOSTS file. Having a more complete list of protected/unprotected domains would give us a better indication if this is an overly aggressive attempt to protect users from legitimate threats or a malicious attempt to protect Microsoft's access to users’ data. Because blocking redirects on microsoft.com certainly seems smart, but blocking redirect of telemetry.remoteapp.windowsazure.com seems suspicious.
- ufmace 6y ago
  I'm sure there's plenty of hackers, government agencies, etc that would just love to redirect telemetry from specific targets' Windows computers to servers they control. Not to say that it going to Microsoft is necessarily that much better, or that they may have deliberately also sabotaged people trying to redirect it to localhost, but still, it's a thing.
  - dividedbyzero 6y ago
    But could they? Verifying the host on the other end is the real deal doesn't appear to be too hard. I would be surprised if Microsoft relied solely on plain DNS for that.
  - abiogenesis 6y ago
    This is what technologies like TLS and certificate pinning are for. Watching the hosts file is only meant to be a nuisance for the end user.
- Causality1 6y ago
  Considering how Windows 10 until very recently pitched an absolute fit when the user tried to change the default browser away from Edge, I'm gonna go with the latter.
ryan29 6y ago
> Edit: On second thought, how long before they just start hard coding IP addresses? I think it’ll eventually go to DoH with hard to block IPs (ex: Cloudflare IPs are tough to block because you break too much stuff). I’ve always believed a large part of the push for TLS, DoH, eSNI, etc. is to eliminate our ability to filter network traffic. It’s sold as a freedom thing, but I’m sceptical.
- pas 6y ago
  If Windows will hard-code IPs, there will be tools to patch them out. And simply not using Windows is a very real possibility too, even if there are obvious inconveniences with going down that route (either OSX or Linux). That said TLS and other network security features are fundamental building blocks, but obviously in oppressive regimes where they stand out they have also the potential to bring the most value. And in parts of the world where network censorship is not a problem, there the features might benefit greedy corporations in a quasi-oligopoly a lot more than the users. But that's not necessarily an argument against these features.
  - AstralStorm 6y ago
    Patching Windows code will break updates and will definitely be flagged as risk. You would have to black hole the IPs on the router, as even Windows Firewall might not have the authority.
    - pas 6y ago
      The risk thing will be patched out too, naturally, I assume, just as with game cracks. And yes, the updates will just restore everything, scream and scold the user. So there will be users that don't update ...

LinuxBender 6y ago

Telemetry isn't even the nasty one. Look for "activity" in your DNS logs. Just try to block that... All the Windows 10 machines (home and pro) on your network will freeze up and hang for extended periods of time. Microsoft wants to know every time you spawn an application, what it was, who launched it. It doesn't matter how you block it, NXDOMAIN, REFUSE, fake IP, null route, all of those will cause machines to hang. A tcp-reset will reduce the impact a little. [Edit] MS may have wised up and consolidated the activity endpoints / vips into another endpoint. You may have to clear cache on the PC and your router, reboot and watch DNS requests as you launch applications to see where they moved. To stop this behavior requires registry changes unless you are on Enterprise or LTSC in which case you can use GPO. There are some free programs that will do the registry tweaks for you. Here is a video talking about manually changing some things [1] and they link to free tools that can do the changes as well [2]. [1] - https://www.youtube.com/watch?v=tgW7iXejfqQ https://www.youtube.com/watch?v=tgW7iXejfqQ [2] - https://www.oo-software.com/en/shutup10 https://www.oo-software.com/en/shutup10

at_a_remove 6y ago
Ah, LTSC ... never has one of my hunch-based technical decisions kept paying off again and again. if only I knew the right people instead of having to get licenses in very sketchy ways.
- jabroni_salad 6y ago
  Just get yourself a volume license and talk to a distributor. You do not need any crazy volume. I was able to get it in place, legitimately, for a metal fabricator that has maybe 20 computers total not including their operational technology (CNC devices) that they wanted LTSC for. https://www.cdw.com/search/?key=ltsc&searchscope=all&sr=1 https://www.cdw.com/search/?key=ltsc&searchscope=all&sr=1
  - at_a_remove 6y ago
    As just a guy? Not so easy. I'm not a company, I'm just a person.

AlexDragusin 6y ago

Skip the Windows HOSTS file and use something like Acrylic DNS[0], works great for me and supports wildcards. I even use it together with the router to have my phone use the DNS and you can see which hosts get connected and so on as you use the phone. It ain't pretty. [0]: https://mayakron.altervista.org/support/acrylic/Home.htm https://mayakron.altervista.org/support/acrylic/Home.htm

cdurth 6y ago
any curated block lists you recommend for the lazy?
- ffpip 6y ago
  I have an extremely basic one on my Windows machine - https://pastebin.com/ZfUv6E2c https://pastebin.com/ZfUv6E2c Bing, Facebook, Windows Web Search and some other sites don't work (unless you use DNS over https in Firefox, which ignores the host files.) Go through r/pihole for the recommended ones.
rasz 6y ago
Running Acrylic DNS (or any other local DNS server) wont do you any good because Windows firewall (or any software firewall for that matter?) cant/wont filter localhost (127.0.0.1), meaning you cant whitelist programs for DNS access :(. I want to not only be in control of what my DNS returns, but also who can access it in the first place. I want a popup the second something other than on my whitelist queries DNS. This works in windows as long as you kill DNSCache service. I havent investigated yet the possibility of using virtual lan adapter with separate subnet dedicated to DNS and if that can be filtered using Windows firewall.

a012 6y ago

For DNS blocking, I've switched my home devices to NextDNS and it works great. It has DoH/DoT, bundles a lot of blocking lists and has no logs option which are all I need. And I can manually add these domain names to blocklist if they're not added in any one yet.

rafaelturk 6y ago

This should somehow be defined as ilegal. I, as user, should have the power, to definitely, unquestionably block MS to track my computer.

jackbrookes 6y ago
You do, by uninstalling Windows.
yjftsjthsd-h 6y ago
I'm actually curious if this happens in the EU, and if so how it doesn't violate GDPR.
- ClikeX 6y ago
  I'm not a lawyer, but I think might depend on what data is being collected here. I believe they'd be fine if it doesn't fall under the "personal data" category. You might actually be accepting some GDPR processing agreement when setting up Windows nowadays. And there's a whole thing in GDPR about grandfathering consent. Which they might fall back on. But like I said, I'm not a lawyer. I'm not qualified enough to know for sure.
  - anoncake 6y ago
    > You might actually be accepting some GDPR processing agreement when setting up Windows nowadays. If you don't know if you "accepted" an agreement, you didnt.
    - ClikeX 6y ago
      I didn't mean it in the sense that it's invisible. I haven't done a Windows install in a while, so I just don't know if they do a privacy agreement in the installation. As I mentioned in another comment. I wonder if they would try to extend Microsoft account privacy agreements to the installation of Windows where that account is logged into.
  - 6y ago

frou_dh 6y ago

If I lost trust in an OS, I would stop running it. Trying to fight an OS as a mere client of the OS is asymmetric warfare

bzb3 6y ago
There are no alternatives, that's why people have to fight Windows.
- numpad0 6y ago
  Closing bugs.launchpad. net/ubuntu/+bug/1 was a mistake, now I understand.
  - bzb3 6y ago
    It was chest-thumping. Mark basically moved the goalposts so he could claim victory. The future he had originally envisioned will never come to fruition.
- tigrezno 6y ago
  What? There are no alternatives because people don't adopt the alternatives. If a mere 10% of the Microsoft user base moved to Linux you'd see lots of changes from comercial software vendors. But I suppose it's easier to pirate Windows and cry in online forums.
- t0astbread 6y ago
  There are alternatives, you just have to accept that not every operating system is exactly like Windows and that it takes time to learn something new. But you can multi-boot while doing that and gradually move your workflow away from Windows. Maybe there's still something that actually doesn't work outside of Windows at the end but the majority of your life will probably be spent on an OS that you (hopefully) don't have to fight.
  - Fauntleroy 6y ago
    If you're using Windows for PC gaming, there are often no real alternatives. It's not always about workflows and compiling.

fortran77 6y ago

These blocks may also prevent Microsoft from getting updates, including new virus scanning profiles. I'd say that blocking access to them could be a risk.

dylan604 6y ago
"Accept our tracking your every move or you don't get virus updates" sounds like "Give me your wallet and I won't shoot you".

jedisct1 6y ago

Block these domains with dnscrypt-proxy instead.

metalliqaz 6y ago

I have Win10 Enterprise from a corporate MSDN license. So, I just used gpedit to disable telemetry. What else should I be doing to my install to get rid of all the "leakiness"?

metalliqaz 6y ago
Actually I found this, which seems to be comprehensive (though a bit out of date) https://proprivacy.com/privacy-service/guides/how-to-disable-windows-10-data-collection https://proprivacy.com/privacy-service/guides/how-to-disable...
- Spunkie 6y ago
  Doesn't seem very comprehensive if you are using an enterprise of LTSC build, no mention of gpedit.
Lammy 6y ago
I set up my own Windows 2019 domain for this same reason and ended up having to go over basically every available GP over the course of a weekend. There are just too many, and a lot of them require careful reading to know what they actually do since MS options tend to be in the form of "Enable the disabling of something" lol. Even the telemetry option itself is like that, since turning it "On" and to Enterprise-only level 0 leaks less data than turning it "Off" https://i.imgur.com/0Iplagu.png https://i.imgur.com/0Iplagu.png
- metalliqaz 6y ago
  cool thanks

fbelzile 6y ago

That's not all. Starting in Windows 8, Windows silently ignores entries in the hosts file for popular domains (ex: facebook.com). The only way to stop this is to add a file exception for C:\Windows\system32\drivers\etc\hosts in Windows Defender. As far as I know, there was no documentation explaining this. Also, I don't know what threat model they're using to make these decisions. If you can edit the hosts file with administrative privileges, you can also add registry entry that adds a file exception in Windows Defender with the same permissions...

bserge 6y ago
It was working for me last year, and I literally just tried it with "127.0.0.1 facebook.com" + "127.0.0.1 www.facebook.com" and it still works.

nvr219 6y ago

Do pi-hole you fools

Wowfunhappy 6y ago

Want to Jailbreak your iPhone with unc0ver? You're probably going to go to unc0ver.dev and download unc0ver.ipa for sideloading. However, if you're on Windows 10, you may find that the the ipa file suddenly disappears from your PC as soon as it has finished downloading. Surprise! Windows Defender detected the Jailbreak and helpfully removed the file to keep you safe! This is not a false positive, Windows Defender literally lists "Jailbreak" as the reason the file is dangerous. Never mind that it's a user-initiated jailbreak for an entirely different, non-Microsoft Operating System! Repeat the same process on macOS—y'know, the OS from a company that actually has an interest in stopping this stuff. Does unc0ver.ipa get deleted by XProtect? Nope! Apple understands that these systems should only ever be used for actual viruses. To do anything else is a severe betrayal of user trust. IMO, Windows Defender has jumped the shark, and sadly, I've now resorted to disabling it on all personal Windows machines.

ZekeSulastin 6y ago
I downloaded the unc0ver IPA just now. Still there. Ran a scan on my downloads folder to see if it gets picked up. Still there. Don't know what the heck is going on with your system shrug
- Wowfunhappy 6y ago
  Huh, well I last did this around a year ago, so it may be that an update to either Windows Defender or unc0ver fixed/avoided the problem. The fact that it happened at all, however, seriously doesn't sit right with me.
  - kbenson 6y ago
    > The fact that it happened at all, however, seriously doesn't sit right with me. It probably detected some of the techniques they used in the file as things used in exploits (since there's little difference in a jailbreak/security exploit from a technical perspective). The fact that it catches is in that case a good thing. That it doesn't catch it anymore might point towards them getting a report that it's a false positive of their automated binary matching, and making an exception to allow it. Apple not catching it could then indicate that either Apple already allowed it, or Apple's exploit detection is less sophisticated and wasn't able to see the problem. I don't know if that situation is correct, but it seems just as plausible to me, and in that case, Defender is doing exactly what I would want, responded to a report exactly as I would want and expect, and has multiple mechanisms to bypass the initial problem (add folder that's not scanned, disable entirely, etc), and your experience with Apple points towards them either being a little quicker with the exception or just worse at doing what I would want.

Justsignedup 6y ago

www.microsoft.com is also used for updates. By doing this block a lot of viruses prevent defender and windows from patching.

pojntfx 6y ago

Use Linux

afrcnc 6y ago

The article's title is misleading and clickbait. Windows is not flagging telemetry. It's flagging remapping of Microsoft domains, which is a very big no-no for every vendor.

JadeNB 6y ago
> The article's title is misleading and clickbait. Windows is not flagging telemetry. It's flagging remapping of Microsoft domains, which is a very big no-no for every vendor. The title is: > Windows 10: HOSTS file blocking telemetry is now flagged as a risk That seems clear to me about what is being flagged. I don't see any implication that telemetry is being flagged, and I'm not quite sure why anyone would think it would be—although I'd love it if Windows were to start reporting that its own telemetry was a risk, I don't see that in the cards.

fractal618 6y ago

It must be hard making decisions at that level.

firebaze 6y ago

Users blocking telemetry using .../etc/hosts are presumably power users, and, as such, are informed about this new twist - and this twist may even inform them that Microsoft uses IPs as a fallback in case DNS resolution fails. The outcome of this stunt may thus be worse than before it. So what is to be gained from this?

wayneftw 6y ago

The Pro and higher versions allow you to just disable Defender via GPO. That’s what I always do anyway.